From 4992af01bbd886f88a4337e4f2ca4e55b60e4752 Mon Sep 17 00:00:00 2001 From: Zen Dodd Date: Fri, 9 Oct 2026 17:12:17 +1000 Subject: [PATCH] docs: correct rsync-ssl verification caveat --- rsync-ssl.1.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/rsync-ssl.1.md b/rsync-ssl.1.md index 030e56f0..abb65442 100644 --- a/rsync-ssl.1.md +++ b/rsync-ssl.1.md @@ -129,11 +129,9 @@ rsyncd.conf](rsyncd.conf.5#SSL_TLS_Daemon_Setup). ## CAVEATS -Note that using an stunnel connection requires at least version 4 of stunnel, -which should be the case on modern systems. Also, it does not verify a -connection against the CA certificate collection, so it only encrypts the -connection without any cert validation unless you have specified the -certificate environment options. +The stunnel backend requires stunnel 4 or newer. It also requires +`RSYNC_SSL_CA_CERT` unless `RSYNC_SSL_ALLOW_INSECURE_STUNNEL=1` explicitly +opts out of server-certificate validation. This script also supports a `--type=gnutls` option, but at the time of this release the gnutls-cli command was dropping output, making it unusable. If